xt_state.c revision ccb79bdce71f2c04cfa9bfcbaf4d37e2f963d684
1/* Kernel module to match connection tracking information. */ 2 3/* (C) 1999-2001 Paul `Rusty' Russell 4 * (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 as 8 * published by the Free Software Foundation. 9 */ 10 11#include <linux/module.h> 12#include <linux/skbuff.h> 13#include <net/netfilter/nf_conntrack.h> 14#include <linux/netfilter/x_tables.h> 15#include <linux/netfilter/xt_state.h> 16 17MODULE_LICENSE("GPL"); 18MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>"); 19MODULE_DESCRIPTION("ip[6]_tables connection tracking state match module"); 20MODULE_ALIAS("ipt_state"); 21MODULE_ALIAS("ip6t_state"); 22 23static bool 24match(const struct sk_buff *skb, 25 const struct net_device *in, 26 const struct net_device *out, 27 const struct xt_match *match, 28 const void *matchinfo, 29 int offset, 30 unsigned int protoff, 31 bool *hotdrop) 32{ 33 const struct xt_state_info *sinfo = matchinfo; 34 enum ip_conntrack_info ctinfo; 35 unsigned int statebit; 36 37 if (nf_ct_is_untracked(skb)) 38 statebit = XT_STATE_UNTRACKED; 39 else if (!nf_ct_get(skb, &ctinfo)) 40 statebit = XT_STATE_INVALID; 41 else 42 statebit = XT_STATE_BIT(ctinfo); 43 44 return (sinfo->statemask & statebit); 45} 46 47static bool check(const char *tablename, 48 const void *inf, 49 const struct xt_match *match, 50 void *matchinfo, 51 unsigned int hook_mask) 52{ 53 if (nf_ct_l3proto_try_module_get(match->family) < 0) { 54 printk(KERN_WARNING "can't load conntrack support for " 55 "proto=%d\n", match->family); 56 return false; 57 } 58 return true; 59} 60 61static void 62destroy(const struct xt_match *match, void *matchinfo) 63{ 64 nf_ct_l3proto_module_put(match->family); 65} 66 67static struct xt_match xt_state_match[] = { 68 { 69 .name = "state", 70 .family = AF_INET, 71 .checkentry = check, 72 .match = match, 73 .destroy = destroy, 74 .matchsize = sizeof(struct xt_state_info), 75 .me = THIS_MODULE, 76 }, 77 { 78 .name = "state", 79 .family = AF_INET6, 80 .checkentry = check, 81 .match = match, 82 .destroy = destroy, 83 .matchsize = sizeof(struct xt_state_info), 84 .me = THIS_MODULE, 85 }, 86}; 87 88static int __init xt_state_init(void) 89{ 90 return xt_register_matches(xt_state_match, ARRAY_SIZE(xt_state_match)); 91} 92 93static void __exit xt_state_fini(void) 94{ 95 xt_unregister_matches(xt_state_match, ARRAY_SIZE(xt_state_match)); 96} 97 98module_init(xt_state_init); 99module_exit(xt_state_fini); 100